{"id":"CVE-2026-120956","kind":"vulnerability","aliases":["CVE-2026-120956"],"related":[],"title":"MongoDB C Driver: malformed server namespace field crashes client and leaks heap memory","description":"The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.","summary":"The MongoDB C Driver does not check the type or format of a namespace field in query responses. A malicious or impersonated MongoDB endpoint can send a malformed value that crashes the client process, reads memory outside a buffer, and returns a small amount of the application's uninitialized heap memory to the server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"libmongoc","fixed":["1.30.15","2.5.8"],"affected":">= 1.25.0, <= 1.30.14 || >= 2.0.0, <= 2.5.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["c","libmongoc","mongodb","package","self-hosted"],"not_affected_if":["no-c-driver","trusted-endpoints-only"],"how_to_check":"Find which libmongoc your app uses: run 'pkg-config --modversion libmongoc-1.0' (or 'libmongoc-2.0' for 2.x), or check mongoc_get_version() / the vendored copy in your build. Affected per an aggregator: 1.25.0 to 1.30.14 and 2.0.0 to 2.5.7. Also check apps that bundle libmongoc through other wrappers (e.g. language drivers built on the C driver) and look at which MongoDB endpoints they connect to.","fix":"Upgrade libmongoc to 2.5.8 (2.x line) or 1.30.15 (1.x line). The release notes list a matching fix but do not name this CVE; confirm against CDRIVER-6501.","status":"open","published_at":"2026-11-03T19:18:00+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:38+00:00","updated_at":"2026-11-03T19:48:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T19:45:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB C Driver: malformed server namespace field crashes client and leaks heap memory","impact":"medium","summary":"The MongoDB C Driver does not check the type or format of a namespace field in query responses. A malicious or impersonated MongoDB endpoint can send a malformed value that crashes the client process, reads memory outside a buffer, and returns a small amount of the application's uninitialized heap memory to the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","c","libmongoc","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"client process crashes, and some uninitialized heap memory is sent back","analyst_note":"Find the affected and fixed libmongoc version ranges and the vendor advisory for CVE-2026-120956 (source listed only NVD, which gave no product ranges).","how_to_check":"- Check whether the application links the MongoDB C Driver (libmongoc), for example with `pkg-config --modversion libmongoc-1.0` or by inspecting the dependency manifest.\n- Note the installed driver version and compare it with the fixed version in the sources, which the sources do not state: unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["no-c-driver","trusted-endpoints-only"],"who_is_affected":"Applications that embed the MongoDB C Driver and connect to a MongoDB endpoint that can return responses to them. The sources say no credentials are needed on the attacker's side, so any client that connects to an untrusted or spoofed endpoint is in scope. Teams that only use MongoDB through other language drivers or managed services that do not embed this C library can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4177,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed libmongoc version ranges and the vendor advisory for CVE-2026-120956 (source listed only NVD, which gave no product ranges).","search":"'-120956':16A,19A '-2026':15A,18A 'alloc':145C 'also':136C 'amount':71B,152C 'applic':74B,111C,130C,155C 'back':161C 'buffer':66B,146C 'c':2A,21B,30B,84C 'caus':127C,137C 'check':34B 'client':9A,60B,110C,129C 'command':170C 'connect':112C 'crash':8A,58B 'credenti':117C 'cve':14A,17A 'driver':3A,31B,85C,139C,181C 'emb':179C 'endpoint':51B,107C,164C 'field':7A,42B,96C,125C 'follow':168C 'follow-up':167C 'format':38B,92C 'heap':12A,77B,159C 'host':27B 'impact':172C 'imperson':49B 'leak':11A 'libmongoc':20A,22B 'limit':174C 'malform':4A,55B,121C 'malici':47B 'memori':13A,63B,78B,142C,160C 'mongodb':1A,23B,29B,50B,83C,106C 'namespac':6A,41B,95C 'need':115C 'outsid':64B,143C 'packag':24B 'process':61B,131C,177C 'queri':44B,103C 'read':62B,141C 'respons':45B,104C 'return':68B,97C,119C 'self':26B 'self-host':25B 'send':53B,149C 'server':5A,81B,100C 'small':70B,151C 'termin':133C 'type':36B,90C 'uniniti':76B,158C 'valid':88C 'valu':56B,122C 'without':114C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed the MongoDB C Driver and connect to a MongoDB endpoint that can return responses to them. The sources say no credentials are needed on the attacker's side, so any client that connects to an untrusted or spoofed endpoint is in scope. Teams that only use MongoDB through other language drivers or managed services that do not embed this C library can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["libmongoc"],"ptokens":["libmongoc"],"labels":["c","high","libmongoc","mongodb","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120956","severity":null,"published_at":"2026-11-03T19:18:00+00:00","modified_at":"2026-11-03T19:18:00+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120956:1526","url":null,"severity":null,"published_at":"2026-11-03T19:48:26+00:00","modified_at":"2026-11-03T19:48:26+00:00","first_seen_at":"2026-11-03T19:48:26+00:00","fetched_at":"2026-11-03T19:48:26+00:00","note":"No MongoDB advisory page found (GHSA list has none for this CVE; Jira CDRIVER-6501 needs login). Release notes for libmongoc 2.5.8 and 1.30.15 (read via newreleases.io mirror of GitHub releases) list 'Fix abort when parsing a cursor namespace without a dot separator', which matches but does not cite the CVE. Affected range >=1.25.0 <=1.30.14 and >=2.0.0 <=2.5.7 comes from the HOL aggregator only. Nothing verified. To settle: the CDRIVER-6501 ticket or the GitHub release text naming the CVE."}],"documents":[{"id":60319,"url":"https://newreleases.io/project/github/mongodb/mongo-c-driver/release/2.5.8","title":"mongo-c-driver 2.5.8 release notes (mirror of GitHub release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":60320,"url":"https://newreleases.io/project/github/mongodb/mongo-c-driver/release/1.30.15","title":"mongo-c-driver 1.30.15 release notes (mirror of GitHub release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":60327,"url":"https://hol.org/guard/security/cves/CVE-2026-120956-remote-abort-and-memory-disclosure-from-a","title":"HOL Guard record for CVE-2026-120956 (aggregator; cites CDRIVER-6501)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}